AI Security & Governance

• Establish company-wide AI usage policies and governance frameworks to ensure safe, ethical, and compliant adoption of internal and third-party AI tools
• Architect and secure in-product AI/ML capabilities, protecting against OWASP LLM Top 10 vulnerabilities (e.g., prompt injection, insecure output handling, data poisoning)
• Implement strict data privacy guardrails to prevent unauthorized exposure of PHI/PII in model training, fine-tuning, and prompt contexts
• Define and enforce model security controls, securing model artifacts, API endpoints, supply chain dependencies, and access controls
• Build continuous monitoring, telemetry, and comprehensive audit logging across all AI/ML workflows to support compliance, threat detection, and incident response

Compliance (SOC 2 & HIPAA)

• Own our path to SOC 2 Type I and Type II: scoping, control design, evidence collection, auditor selection and management, and ongoing readiness
• Own ongoing HIPAA Security Rule compliance, including risk assessments, policies, BAAs, breach notification procedures, and audit readiness
• Get the most from Vanta: tune integrations, automate evidence collection, and drive remediation of failing tests
• Maintain the security policy library, risk register, and vendor risk management program
• Support customer and payer security questionnaires and due diligence

Endpoint & Corporate Security

• Work with outsourced IT to manage security for laptops and workstations: MDM, disk encryption, EDR, patching, hardening baselines, and device compliance
• Own identity and access management: SSO, MFA, RBAC, joiner/mover/leaver processes, and periodic access reviews
• Work with People ops to run security awareness and HIPAA training programs

Detection, Response & Resilience

• Build logging, monitoring, and alerting for the platform and corporate environment (SIEM or equivalent)
• Develop and test our incident response plan, run tabletop exercises, and lead response when incidents occur
• Partner with engineering on disaster recovery, backup, and business continuity planning

Leadership

• Define the security roadmap and communicate risk clearly to the CTO and executive team
• Mentor engineers and build a security-conscious culture, such as a security champions model
• Build the business case for tools, vendors, and (eventually) additional security headcount

What you bring:

• 8+ years in security engineering, with significant hands-on experience securing production cloud environments, ideally AWS-heavy
• Deep AWS security expertise (IAM, networking, encryption/KMS, logging and detection services, serverless security)
• Experience securing PostgreSQL and other data stores containing regulated or sensitive data
• Strong application and API security background, and the ability to review code and architecture and work effectively with developers
• Direct experience owning or leading a SOC 2 audit (Type I and/or Type II) and HIPAA compliance, ideally in a healthcare or health-tech environment handling PHI
• Experience with Infrastructure-as-Code (Pulumi, CloudFormation, or CDK) and CI/CD security
• Experience with AI security, LLM application security, and guarding against OWASP LLM Top 10 vulnerabilities
• Strong incident response experience
• Excellent communication: you can explain risk to engineers, executives, auditors, and customers alike

Nice to have:

• Experience with compliance automation platforms such as Vanta, Drata, or Secureframe
• Experience securing real-time communication or video platforms (WebRTC)
• Familiarity with HITRUST, ISO 27001, or NIST frameworks
• Experience at a startup or scale-up where you built a security program from scratch
• Relevant certifications (AWS Security Specialty, CISSP, CCSP, OSCP, or similar)
• Experience with pediatric or behavioral health data and the added privacy considerations that come with minors' information

What we offer:

• $171,000- $199,500 annual salary
• Equity options in a high-growth, venture-backed company.
• Comprehensive medical, dental, and vision.
• Generous PTO and remote-first flexibility.

More About AnswersNow

AnswersNow welcomes applicants of all backgrounds, experiences, and abilities. We believe a diverse team is a strong team, and are committed to provide a fair and equitable experience for every candidate. If you require reasonable accommodations at any stage, we encourage you to reach out. We’re here to support!

Learn more about us at getanswersnow.com.

E-Verify & Right to Work
AnswersNow participates in E-Verify and electronically verifies the work authorization of all new hires upon employment. E-Verify is only used after a job offer has been accepted; it is not used to pre-screen applicants.

For more information, view the E-Verify Participation and Right to Work posters in English and Spanish.

Compensation: $150K - $215K